04 - DNS Service

Introduction to DNS

Terminology

Before you continue with this topic, please make sure that you understand the following terminology.

DNS Root Zone

For more detailed information, see DNS root zone article on Wikipedia.

The global DNS root servers were previously overseen by ICANN (Internet Corporation for Assigned Names and Numbers) and by the National Telecommunications and Information Administration (NTIA), an agency of the United States Department of Commerce.

As of Oct 1, 2016, ICANN has delegated the duties to IANA (Internet Assigned Numbers Authority), which has outsourced the distribution services to Verisign (a US-based corporation).

Due to limitations of the UDP protocol, there are only 13 global root servers from a to m.

For the sake of redundancy and load balancing, each root server is a cluster of many servers that respond to anycast requests. (See https://root-servers.org/)

When configuring a DNS server for the first time, the IP address of at least one root server is needed to retrieve the current list of all other name servers.

DNS Name Registry and Distribution

DNS Resolver

Resolver is a client software in an end device that "resolves" DNS names to IP addresses. A resolver software is usually included with or is built into an OS or network device software/firmware. DNS names are largely for humans, and machines using TCP/IP do not understand them. Any network-connected device using TCP/IP protocol must transmit network packets by including a destination IP address in the IP headers. The resolver software uses the DNS protocol to contact upstream DNS servers to obtain IP addresses for any DNS name before your system is able to assemble and transmit network packets to that destination.

Ubuntu uses systemd.resolved (8) as its resolver. Here are some relevant files and configurations:

Example of a DNS query operation

This is an example of a "recursive DNS query" where the DNS server communicates with several other DNS servers to find the IP address of a specific host before returning the IP to the requesting DNS client.

Example Address: fqdn.subdomain.domain.tld. (notice the . at the end!)

  1. Client request arrives at the server
  2. A resolver breaks the name into its “labels” from right to left
    1. TLD is queried from a root name server (who knows about tld.) -> returns authoritative TLD (address of the NS to ask about domain.tld.)
    2. Domain is queried from TLD -> returns the NS for the domain (address of the NS to ask about subdomain.domain.tld.)
    3. Subdomain is queried from the Domain server -> returns NS server for subdomain (address of the NS to ask about fqdn.subdomain.domain.tld.)
    4. FQDN is queried from the second NS server -> returns the IP address for the host that we are trying to reach
  3. DNS server returns the IP address to the host to the requesting client, and may also keep it cached for future use, in case another client asks

Freehand Drawing.svg

Linux Client DNS Utilities

Ubuntu provides the dnsutils package containing several utilities useful for troubleshooting and NS lookup tasks. Some included utilities are:

Reverse Lookup (rDNS)

You can ask a DNS server to find an IP address from a DNS name, or you can ask for a "reverse lookup" where you provide the IP address in order to find a FQDN. For a reverse lookup to be successful, the NS server must be configured with the appropriate PTR record entries in the zone file. For more information, see https://en.wikipedia.org/wiki/Reverse_DNS_lookup.

BIND9

If you are interested in the history of BIND, then visit https://www.isc.org/bindhistory/.

BIND has been around since 1983 and is still in use extensively. If you are administering any websites or are in charge of managing domains, chances are your DNS service provider will require you to maintain and provide your domain name configuration in a format that aligns with the BIND zone file configuration.

BIND can act as a primary, secondary, forwarding, or caching DNS server.

The main BIND configurations are located under /etc/bind. Here are some of the configuration files and their intended functions:

In Ubuntu, the BIND service is managed using systemd:

Note: The named-checkzone and named-checkconf utilities only check for syntax and cannot detect wrong or missing information!

BIND logs are sent to syslogs and are stored at /var/log/syslog. You can query or search syslogs for troubleshooting or monitoring BIND.

Example Zone File

Even if you never set up your own DNS server, where you may need to create your own zone files for your domain, you will need to understand exactly what goes into a zone file in order to be able to configure any domain hosted at any provider. You will also need to know the meaning of these directives when using tools such as nslookup for troubleshooting or investigating a DNS name. The following are the important directives in the zone file:

Here is an example of a zone file:

$ORIGIN example.com.     ; designates the start of this zone file in the namespace
$TTL 3600                ; default expiration time (in seconds) of all RRs without their own TTL value
example.com.  IN  SOA   ns.example.com. username.example.com. ( 2020091025 7200 3600 1209600 3600 )
; Legend for the above numbers:
;	2020091025		; Serial number, increment with every change
;	7200			; Refresh
;	3600			; Retry
;	1209600			; Expire 
;	3600			; Negative Cache TTL
;
example.com.  IN  NS    ns                    ; ns.example.com is a nameserver for example.com
example.com.  IN  NS    ns.somewhere.example. ; ns.somewhere.example is a backup nameserver for example.com
example.com.  IN  MX    10 mail.example.com.  ; mail.example.com is the mailserver for example.com
@             IN  MX    20 mail2.example.com. ; equivalent to the above line, "@" represents the zone origin
@             IN  MX    50 mail3              ; equivalent to the above line, but using a relative host name
example.com.  IN  A     192.0.2.1             ; IPv4 address for example.com
              IN  AAAA  2001:db8:10::1        ; IPv6 address for example.com
ns            IN  A     192.0.2.2             ; IPv4 address for ns.example.com
              IN  AAAA  2001:db8:10::2        ; IPv6 address for ns.example.com
www           IN  CNAME example.com.          ; www.example.com is an alias for example.com
wwwtest       IN  CNAME www                   ; wwwtest.example.com is another alias for www.example.com
mail          IN  A     192.0.2.3             ; IPv4 address for mail.example.com
mail2         IN  A     192.0.2.4             ; IPv4 address for mail2.example.com
mail3         IN  A     192.0.2.5             ; IPv4 address for mail3.example.com
$ORIGIN example.com.     ; designates the start of this zone file in the namespace
$TTL 3600                ; default expiration time (in seconds) of all RRs without their own TTL value
example.com.  IN  SOA   ns.example.com. username.example.com. ( 2020091025 7200 3600 1209600 3600 )
; Legend for the above numbers:
;	2020091025		; Serial number, increment with every change
;	7200			; Refresh
;	3600			; Retry
;	1209600			; Expire 
;	3600			; Negative Cache TTL
;
example.com.  IN  NS    ns                    ; ns.example.com is a nameserver for example.com
example.com.  IN  NS    ns.somewhere.example. ; ns.somewhere.example is a backup nameserver for example.com
example.com.  IN  MX    10 mail.example.com.  ; mail.example.com is the mailserver for example.com
@             IN  MX    20 mail2.example.com. ; equivalent to the above line, "@" represents the zone origin
@             IN  MX    50 mail3              ; equivalent to the above line, but using a relative host name
example.com.  IN  A     192.0.2.1             ; IPv4 address for example.com
              IN  AAAA  2001:db8:10::1        ; IPv6 address for example.com
ns            IN  A     192.0.2.2             ; IPv4 address for ns.example.com
              IN  AAAA  2001:db8:10::2        ; IPv6 address for ns.example.com
www           IN  CNAME example.com.          ; www.example.com is an alias for example.com
wwwtest       IN  CNAME www                   ; wwwtest.example.com is another alias for www.example.com
mail          IN  A     192.0.2.3             ; IPv4 address for mail.example.com
mail2         IN  A     192.0.2.4             ; IPv4 address for mail2.example.com
mail3         IN  A     192.0.2.5             ; IPv4 address for mail3.example.com

Interesting Files, Utilities, and Commands